Follow Us

Team Foundation Server Default Groups, Permissions, and Roles

When you create a new project in Team Foundation Server, new project-level groups are created for that project, by default, and are assigned permissions to access resources appropriate to that group. To customize projects to better suit your business needs, you must understand what permissions are assigned to which users and groups by default, and what permissions you might want to add to any users or groups you might add. Additionally, if you want to closely align your users with the roles described for MSF for Agile Software Development or MSF for CMMI Process Improvement, you must understand how to align those roles with the default groups already assigned to the project. Alternatively, you can create groups that associate directly with each of those roles, and assign those groups the permissions appropriate to the role.

Default Groups and Permissions

Whenever you create a project in Team Foundation Server, groups are created at the project level. By default, each of those groups has certain permissions assigned to them. You can add permissions to these default groups in addition to any groups or users you want to add at the server or project level.

Server-Level Groups and Permissions

By default, the following groups exist at the server level when you install Team Foundation Server:

SERVERTeam Foundation Administrators Members of this group can perform all operations for Team Foundation Server. This group should be restricted to the smallest possible number of users who need total administrative control over Team Foundation Server.

SERVERTeam Foundation Valid Users Members of this group have access to Team Foundation Server. This group automatically contains all users and groups that have been added anywhere within Team Foundation Server. You cannot modify the membership of this group through the user interface.

SERVERService Accounts Members of this group have service-level permissions for Team Foundation Server. By default this group contains the service account supplied during installation. If you want to add new accounts to this group, you must add them using the TFSSecurity command-line tool. This group should only contain service accounts and not user accounts or groups (unless that group only contains service accounts).

By default, these groups have the following permissions set for them.

Permission Name

By default, set for:

Consider adding to:

Access the source control system

All users in a project (default, not changeable)

Any manually added users or groups.

Administer shelved changes

Team Foundation Administrators, Service Accounts

Manually-added users or groups who might or must delete shelvesets created by other users.

Administer warehouse

Team Foundation Administrators, Service Accounts

Manually-added users or groups who might or must change warehouse settings through the WarehouseController.asmx Web service ChangeSetting Web method.

Administer workspaces

Team Foundation Administrators, Service Accounts

Manually-added users or groups who might or must create workspaces for other users and delete workspaces created by other users.

Create a workspace

Team Foundation Administrators, Team Foundation Valid Users

None.

Create new projects

Team Foundation Administrators

Project Administrators who will regularly be creating new projects. In order to successfully create new projects, users must have Administrator permissions in Windows SharePoint Server and Content Manager permissions in SQL Reporting Services.

Edit Server-Level information

Team Foundation Administrators

None.

Alter Trace Settings

Team Foundation Administrators

Other server administrators who might or must change the trace settings for gathering more detailed diagnostic information on Team Foundation Server Web services.

Trigger Events

Team Foundation Administrators, Service Accounts

None. Adding this permission to other users has the potential to cause denial of service attacks.

Manage Process Template

Team Foundation Administrators

Project Administrators and any manually-added users or groups, such as process specialists, who might or must create, edit, download, and upload process templates to Team Foundation Server.

View Server-level information

Team Foundation Administrators, Team Foundation Valid Users

None.

Project-Level Groups and Permissions

By default, the following groups exist at the project level:

Project NameProject Administrators Members of this group can administer all aspects of the team project, although they cannot create new projects.

Project NameContributors Members of this group can contribute to the project in multiple ways, such as add, modify, and delete code, create and modify work items, and so on.

Project NameReaders Members of this group can view the project but not modify it.

Project NameBuild Services Members of this group have build service permissions for the project. This group should only contain build service accounts and not user accounts or groups (unless that group only contains build service accounts).

Besides these project-level accounts, two of the server-level accounts also appear in every Team Foundation Server project by default:

SERVERTeam Foundation Administrators

SERVERTeam Foundation Valid Users

By default, these groups have the following permissions set for them.

Permission Name

By default, set for:

Consider adding to:

Administer a build

Project Administrators, Team Foundation Administrators

Manually added users or groups who might or must delete completed builds and terminate current builds in progress.

Delete this project

Project Administrators, Team Foundation Administrators

None.

Edit build quality

Project Administrators, Team Foundation Administrators

Any manually-added users or groups that might or must add information about the quality of the build through the Team Foundation Build user interface.

Edit project-level information

Project Administrators, Team Foundation Administrators

None.

Publish Test Results

Project Administrators, Team Foundation Administrators

Any manually-added users or groups that might or must add and remove test results on the team project portal and add or remove test runs.

Start a Build

Project Administrators, Contributors, Team Foundation Administrators

Any manually-added users or groups that might or must start a build through the Team Foundation Build user interface or from the command line.

Permissions Associated With the MSF for Agile Software Development Roles

If you created your team project using the MSF for Agile Software Development process template, you might want to assign your users to groups that correspond with the roles for MSF for Agile Software Development. You can do this in one of two ways. You can assign your users to the default group that most closely aligns to the permissions that are required for each role. Alternatively, you can create groups for each role, assign the appropriate permissions to that group, and then add the users who perform that role.

Assigning Users to Default Groups Based On Their MSF for Agile Software Development Roles

You can assign users to default groups based on their MSF for Agile Software Development roles. Although these groups do not directly correspond to each role, it is relatively simple to add users to these groups, and you do not have to create new groups and add permissions for the groups at the server, project, area, and source control levels. The disadvantage to this approach is that you lose some of the fine granularity of permission and control that you can have by adding groups specifically based on each role.

The following table provides suggestions for which default group best aligns with each MSF for Agile Software Development role.

Agile Role

Add to Default Group

Architect

Contributor

Business Analyst

Contributor

Developer

Contributor

Project Manager

Project Administrator

Release Manager

Project Administrator

Tester

Contributor

Creating Groups That Correspond to MSF for Agile Software Development Roles and Assigning Permissions

You can create custom groups based on each MSF for Agile Software Development role and assign users to these groups. An advantage of creating these groups instead of using the default groups gives is that you have you more control over roles and permissions. The disadvantage to this approach is that you must create new groups and add permissions for the groups at the server, project, area, and source control levels.

Note If you create custom groups to correspond with roles, you must set appropriate permissions for each new group in Windows SharePoint Services, Reporting Services, and either in Active Directory or Local Users and Groups on the Team Foundation Server computers. This is in addition to setting Team Foundation Server permissions.

The following table provides suggestions for which permissions are appropriate for each MSF for Agile Software Development role.

Agile Role

Server

Project

Area

Source Control

Architect

Start a build

View project-level information

Edit work items in this node

View this node

View work items in this node

Read

Check out

Check in

Label

Lock

Business Analyst

View project-level information

View this node

View work items in this node

None

Developer

View project-level information

Start a build

Edit work items in this node

View this node

View work items in this node

Read

Check out

Check in

Label

Lock

Project Manager

Create new projects

Manage process template

View project-level information

Administer a build

Delete this project

Edit project-level information

Start a build

Create and order child nodes

Delete this node

Edit this node

Edit work items in this node

View this node

View work items in this node

Read

Check out

Check in

Label

Lock

Revise other users’ changes

Unlock other users’ changes

Undo other users’ changes

Administer labels

Manipulate security settings

Check in other users’ changes

Release Manager

View project-level information

Edit project-level information

Edit work items in this node

View this node

View work items in this node

None

Tester

View project-level information

Edit build quality

Publish test results

Edit work items in this node

View this node

View work items in this node

Read

Check out

Check in

Label

Lock

Permissions Associated With the MSF for CMMI Process Improvement Roles

If you created your team project using the MSF for CMMI Process Improvement process template, you might want to assign your users to groups that correspond with the roles for MSF for CMMI Process Improvement. You can do this in one of two ways. You can assign your users to the default group that most closely aligns to the permissions that are required for each role. Alternatively, you can create groups for each role, assign the appropriate permissions to that group, and then add the users who perform that role.

Assigning Users to Default Groups Based On Their MSF for CMMI Process Improvement Roles

You can assign users to default groups based on their MSF for CMMI Process Improvement roles. Although these groups do not directly correspond to each role, it is relatively simple to add users to these groups, and you do not have to create new groups and add permissions for the groups at the server, project, area, and source control levels. The disadvantage to this approach is that you lose some of the fine granularity of permission and control that you can have by adding groups specifically based on each role.

The following table provides suggestions for which default group best aligns with each MSF for CMMI Process Improvement role.

You can create custom groups based on each MSF for CMMI Process Improvement role and assign users to these groups. These groups have much more granularity and control than just using the default groups. The disadvantage to this approach is that you must create new groups and add permissions for the groups at the server, project, area, and source control levels. Because MSF for CMMI Process Improvement has many roles, you should carefully consider what level of auditing, granularity, and control you need for your project before investing the time to create groups for each role.

NoteIf you create custom groups to correspond with roles, you must set appropriate permissions for each new group in Windows SharePoint Services, SQL Reporting Services, and either in Active Directory or Local Users and Groups on the Team Foundation Server computers. This is in addition to setting Team Foundation Server permissions.

The following table provides suggestions for which permissions are appropriate for each MSF for CMMI Process Improvement role.